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A Method I'or Prevention Key .Share Attacks 



This invention relates to cryptographic systems anil in particular, to improvements in 
key agi cement protocols lor preventing kcy-shaie attacks thereon. 

BACKGROUND OF Til Li INVENTION 

Key establishment is the process by which two (or more) entities establish a shared 
secret key. 

The key is subsequently used lo achieve some cryptographic goal, such as 
confidentiality or data integrity. Ideally, the established key should have precisely the same 
attributes as a key established face-to-race it should be distributed uniformly at random from 
(he key space, and no unauthorized (and computationally bounded) entity should learn 

anything about the key. 

Broadly speaking, there arc two kinds of key establishment protocols: key transport 
protocols in which a key is created by one entity and securely transmitted to the second 
entity, and key agreement protocols in which both parlies contribute information which 
jointly establish the shared secret key. 

Let A and B be two honest entities, i.e., legitimate entities who execute the steps of a 
protocol correctly. Informally speaking, a key agreement protocol is said to provide implicit 
key authentication (of B to A) if entity A is assured that no other entity aside from a 
specifically identified second entity B can possibly Ica.n the value of a particular secret key. 
Note that the property of implicit key authentication does not necessarily mean that A is 
assured of B actually possessing the key. A key agreement protocol which provides implicit 
key authentication to both participating entities is called an authenticated key agreement 
(AK) protocol. 

Informally speaking, a key agreement protocol is said to provide explicit key 
confirmation (of B to A) iT entity A is assured that the second entity 13 has actually computed 
the agreed key. The protocol provides implicit key confirmation if A is assured that M can 
compute the agreed key. While explicit key confirmation appears to provide stronger 
assurances to A than implicit key confirmation (in particular, the former implies the latter), it 
is possible that, far all practical purposes, the assurances arc in fact the same. This is because 
B may delete the key immediately after the explicit key confirmation process. 
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irboih implicit key aiilhcnlicaliou ami (implicit or explicit) key confirmation (of II to 
A) arc provided, then the key establishment protocol is said to provide explicit key 
authentication (oTB to A). A key agreement protocol which provides explicit key 
authentication to both pa.ticipaling entities is called an authenticated key a^cenurnt will, key 
confirmation (AKC) protocol. 

An unknown key-share (UKS) attack on an AK or AKC protocol is an attack 
whereby an entity A is coerced into sharing a key with an entity B without A's knowledge, 
i.e., when A believes the key is shared with some entity E * It. Notice that if an AK or AKC 
protocol succumbs to a UKS attack, then this docs not contradict the implicit key 
authentication property of the protocol. By definition, the provision of implicit key 
authentication is only considered in the case where A engages in the protocol with an honest 

entity (which 12 isn't). 

The station-to-stalion (STS) protocol is a Diffie-Hcllman-based AKC protocol that 
purports to provide botli (mutual) implicit key authentication and (mutual) key confirmation, 
and additionally appears to possess desirable security attributes such as forward secrecy and 
key-compromise impersonation. There arc two main variants of STS as described in VV. 
Di ("fie et al., "Authentication and authenticated key exchanges", Designs, Codes and 
Cryptography, 2 (1992) 107-125. One in which key confirmation is provided by using the 
agreed key K in a MAC algorithm (STS-MAC), and another in which K is used in an 
encryption scheme (STS-ENC). STS-MAC is preferred over STS-liNC in many practical 
scenarios. Moreover, the use of encryption to provide key confirmation in STS-ENC is 
suspect - the goal of an encryption scheme is to provide confidentiality, rather than as an 
authentication mechanism Tor proving possession of a key. One advantage of STS-P.NC over 
STS-MAC is that the former can facilitate the provision of anonymity. 

Many protocols related to STS have appeared in the literature. It should be noted, 
however, that these protocols cannot be considered minor variants of S I S. 

For the sake of clarity, notation used in the specification, is initially outlined as 
follows: 

A. B Honest entities. 

[< The adversary. 

S A A's (private) signing key for a signature scheme S. 

P A A's (public) verification key for S. 

S A (M) A's signature on message M. 
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CciIa a ' s L-cMilicalc containing A's name. A's public signaltiic key I'A. and possibly 

some other in(bnuntiun. 
\\ K (M) Encryption oI'M using a synimeti ic-kcy encryption scheme with key K. 

MAC'k(M) Message authentication coilc of M inkier key K. 

q w „ Diflic-Ilcllinan parameters; a is an clement of prime order // in the hnite 

group (/. 

fA A's ephemeral Diffic-Hellnian private key, I < r A <n-\. 

K Ephemeral Diffie-I lellman shared secret; K = a'-'"' 

The two STS variants are presented below. In both descriptions, A is called the initiator, 
while B is called the rcspondcr. 

STS-MAC protocol 

The S I S-MAC protocols is depicted below. Initiator A selects a random secret integer r A , 
1 </,<«- 1 , and sends to B the message ( I ). Upon receiving ( 1 ), B selects a random secret 
integer r„,l <r H <n-\, computes the shared secret A' = a'-''' , and sends message (2.) to A. 
Upon receiving (2), A uses Cert,, to verify the authenticity ofB's signing key P„, verifies Bs 
signature on the message (a " , a' A ) , computes the shared secret K, and vcri fies the M AC ' on 
S B (a r \n r1 ) A then sends message (3) to B. Upon receipt of (3), B uses Ccrt A to verify the 
authenticity of A's signing key PA, verifies A's signature on the message (a' 4 ,a" ) and 
verifies the MAC on S B (a'\a") - ITat any stage a check or verification performed by A 
or B fails, then that entity terminates the protocol run, and rejects. 



(1) A -> // A, oc 

(2) A <- II Cert,,, a'\(S B {a" ,a' A ),MAC K {S B {a'\a rA )) 

(3) A->n Ccrl A . S A (a' A ,a" , ),MAC\(S t (u\xx"')) 



STS-ENC protocol 

The STS-ENC protocol is given below. For the sake of brevity, the checks that should 
performed by A and B are henceforth omitted. 
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(1) A ~» // A, (T 

(2) A <- H Cert,,, a" , A ,- (A', ia" , a rA )) 

(3) .1 -> 7J CcrtA. /:'» -(S A (a' A ,a")) 

5 | n onlcr Id more clearly understand an unknown key-share (UKS) attack on a key 

agreement protocol, we consider a hypothetical scenario where a UKS attack can have 
damaging consequences. Suppose that A is a bank branch and B is an account holder. 
Certificates are issued by the bank headquarters and within each certificate is the account 
information of the holder. Suppose that the protocol for electronic deposit of funds is to 
10 exchange a key with a bank branch via an AKC protocol. At the conclusion of the protocol 
run, encrypted funds arc deposited to the account number in the certificate. Suppose that no 
t=i further authentication is done in the encrypted deposit message (which might be the case to 

NO s; ,ve bandwidth). If the UKS attack mentioned above is successfully launched then the 

s p deposit will be made to l£'s account instead of B's account. 

J 1 5 | t i s important to observe that a UKS attack on an AKC protocol is a much more 

1 serious consideration than a UKS attack on an AK protocol (which does not provide key 

* confirmation). 

!y No key agreed in an AK protocol should be used without key confirmation. Indeed. 

J some standards take the conservative approach of mandating key confirmation of keys agreed 

£ 20 in an AK protocol. If appropriate key confirmation is subsequently provided, then the 
° attempt at a UKS attack will be detected. For this reason, the above hypothetical scenario (in 

particular, the assumption thai no further authentication is performed after termination of the 
key agreement protocol) is realistic iTan AKC protocol is used (since key confirmation has 
already been provided), and unrealistic iTan AK protocol is used (since key confirmation has 

25 not yet been provided). 

In a UKS attack against the rcspondcr, the adversary V. registers A's public key PA as 
its own; i.e., P n = IV When A sends B message (I), E intercepts it and replaces the identity A 
with L. I- then passes message (2) from B to A unchanged. Finally H intercepts message (3 ). 
and replaces Ccrt A with Ccil L . Since P A = P n , wc have S A (a'\a") = S E (a-' ,a" ) . Hence. IS 

30 accepts the key K and believes that K is shared with 11, while in fact it is shared with A. 

Note that E docs not learn the value of K. The attack is depicted below. The notation /(!- > H 
means that A transmitted a message intended for B, which was intercepted by the adversary 
and not delivered to B. 
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(1) /!!-> I! 'Utt rA 
(D /; --» n l:.,a' A 

(2) £«- « Cert,,. rr'*..V l ,(a". <: r'- , ),AMC- jr (.V 1 ,(fl' , ".«' , - < )) 
(2 .) ,| <_ E Cert,,, rr-.-V.^".^^.^.-!^.!^^^".^)) 

(3) /!!-> ZJ CcrlA, S,( tf , ",^),AMC,( 1 V,(V fl ,^)) 
(3 .) E _> /, . Ccrl A , S A (a" MAC >> WM"<«' A » 



Entity H can similarly launch a UKS attack against the initiator A by registering B's 
public key PB as ils own. The atlack is depicled below. 



(1) /!-»/: A,a' A 
(V) E-> D 'U<x' A 

(2) Cert,,, «' , ,A , l (a",tr M ),.»WC I (.V,(""."")l 
(2 ., A <_ E Cert,, ,/'^A / ,(a'^ ^ r' , ),A//^C,(.V fl (a'^a' , )) 

(3) A _> /T Ccrt A . SM'' ^' A l MAC * {}: * {a " * a ' A)) 
(3 . } E —> H CcrlA, .V,(«' fl ,^''),^Q(.V,(«" fl ,a M )) 

In describing new on-line UKS attacks we make the following assumptions. First, we 
20 assume that the signature scheme S used in STS has the following duplicate-signature key 
selection property. Suppose that I> A (A's public key,, and A's signature sA on a message M 
are known. Then Ihe adversary is able lo select a key pair CIV.; S,) with respect to whu:h s A ,s 
also E's signature on (lie message M. 

Second, E is able to gel its public key certified during a run of the STS protocol. This 
25 assumption is plausible, for instance, in situations where delays in the transmission of 
messages arc normal, and where the CA is on-line. 

This new UKS atlack against the respondcr is similar to the public key subsli.u.ion 
attack against the responder as described earlier. After A sends message (3), E intercepts it 
and selects a key pair (I>, : ,S r ,) for the employed signature scheme such thai 
30 S E {a'\a' B ) = S 4 {a' A ,a' B ) . E then obtains a certificate Cert,: for I',, and transmits message 

(3*) to n. 
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This new UKS attack against the initiator is similar to the public key substitution 
attack against the initiator described above. After B sends message (2), F. intercepts it and 
selects a key pair (Pli; SI*) Tor the employed signature scheme such that S ( 
5 S F (u'\rr' 4 ) = S R (a' B % a' A ). H then obtains a certificate Ccrt|.; for P|., anil transmits 
message (2') to A. 

In the on-line UKS attacks, the adversary knows the private key SII corresponding to 
its chosen public key P E - Hence, unlike the case of public key substitution attacks, the on- 
line attacks cannot be prevented by requiring that entities prove to the certificate-issuing 
10 authority possession of the private keys corresponding to their public keys during the 
certification process. 

The applicants have discovered that the STS protocols have some security attributes 
that are lacking. It is, thus desirable to implement a STS protocol wherein unknown key- 
share attacks arc minimized. 

15 

SUMMARY OF THE INVENTION 

According to a general aspect of the invention there is provided in a key agreement 
protocol the steps of including the identities or the sender and intended receiver as well as a 
How number in the message being signed to thereby prevent an on-line UKS attack. 
2() According to one aspect of (he invention, there is provided in an STS-M AC protocol, 

including one ofthe entities A sending its certificate Cert A in a first How to thereby minimize 
an on-line UKS attack against a rcsponder B. 

According to a further aspect ofthe invention, there is provided the step of implicit, 
rather than explicit, key confirmation. 
25 A still further aspect ofthe invention provides for including the identities ofthe 

entities in the key derivation function, rather than the signed message. 

A further feature ofthe invention provides for the application thereof to STS-ENC 
and STS-M AC protocols. 

30 BRIEF DESCRIPTION OF THE DRAWINGS 

These and other features of the preferred embodiments ofthe invention will become 
more apparent in the following detailed description in which reference is made to the 
appended drawings wherein: 
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Figure 1 is a schematic diagram of a data communication system. 

DI.:TAIUiD DESCRIPTION OV A PREFERRED EMBODIMENT 
5 Referring to figure I , an electronic communication system 1 0 includes a pair ol 

correspondents, A and H. designated as a sender 1 2 and rccipic.il 14, connected by a 
communication channel 16. Each of the correspondents 1 2 ami 14 includes an encryption 
unit 18 and 20 respectively that may process information and prepare it for transmission 
through the channel 16. A third entity 22 is depicted as the adversary. 
,0 Ina key establishment/agreement protocol, according to the embodiment of the 

present invention, the following How of messages take place between the entities: 
Item I. 

(1) A-*F. /I-"" 

(2) A «- U Ccrtu. a''[,SAlJ1,A,a\a<lMAC K (S tt (2J!,A,a\ar>< )) 
15 (3M -» U CcrU. SAXAA^^lMAC^SAXAJ^n ^a'")) 



In the original STS-MAC protocol described in the background section and the 
modification presented above, the agreed key K is used as the MAC key for the purpose of 
providing explicit key confirmation. A passive adversary now has some information about K. 

20 namely the MAC of a known message under K. The adversary can use this to distinguish K 
from a key selected uniformly at random from the key space 1 The key space here is 
K = \a' :\<i<n-\). Another drawback of providing explicit key confirmation in tins way 
is that the agreed key K may be subsequently used with a different cryptographic primitive 
than the MAC algorithm | this violates a fundamental cryptographic principle that a key 

25 should not be used for more than one purpose. 

Two ways of achieving implicit, rather than explicit, key confirmation arc : 

(i) derive two keys K || A" = U\a' A ' B ) from the same shared secret (here, H is a 

cryptographic hash function); and 

i v 1 1 (,* rA ' B \ -nif 1 K - II (a'"") where Hi and H 2 arc 
30 (ii) derive two keys h = //,(<* ) dIUJ k-'^K" > 

independent random oracles 2 
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A' is used as the MAC key for (lie session, while K is used as the agreed session key. The 
revised protocol is depicted helow. 



5 Item 2. 



(1) A > /: A,ir' A 

(2) A <-fi Ccrlu. a r \S fi (2J^A i a r \a rJ ) i MAC K (SJ2JKA,a'\n tA n 

(3) A->B Ccrt A , 6^(3, /*, /^ r *\a'* 

10 Instead of including the identities of the entities in the signed message, one could 

include them in the key derivation function, whose purpose is to derive the shared key from 
the shared secret a rAtlt . In the protocol of item L the shared secret key would he 
A' = II((i rA,Ii AJ}), while in the two protocols of item "2, the shared keys would be 
K || A" = H(a" ir *'A,B)*ml (ii) K' = //, (a rArB /J, B) and A" = II 2 (o rArP - AJi) 

j 5 However, key derivation functions have not been well-studied by the cryptographic 

community the desirable properties of a key derivation function have not yet been specified. 
Hence the protocols presented in items 1. and 2. arc preferred over the variants which include 
identities in the key derivation function. 

The protocols in item 2 provide implicit key confirmation. While the assurance that 

20 the other entity has actually computed the shared key K is not provided, each entity docs 
get the assurance that the other has computed the shared secret a rA,B . Implicit key 
confirmation is still provided (to a somewhat lesser degree) if the MACs are not included 
in the flows. The revised protocol is shown below: 
Item 3. 

25 (1) // -> B A,a rA 

(2) A B Cert n% a'\S B {2Ji,A 9 a'\a rA ) 

(3) A->B Cert A ,S A (3.A,B,a'\a'*) 

The on-line UKS attacks cannot be launched on STS-ENC because the signatures 
30 S A (<i r '\a' R ) and S B {a r \a rA ) are not known by the adversary. However, as a precautionary 
measure, we recommend that STS-ENC be modified so that the flow number and identities of 
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the sender and intended recipient be included in the signed messages or that the identities he 
included in the key derivation (unction above. 

Although the invention has been described with reference to certain specific 
embodiments, various modifications thereof will he apparent to those skilled in the ail 
without departing from the spirit and scope of the invention as outlined in the claims 
appended hereto. For example, the items arc described witli respect to the STS-MAC they 
can equally well be defined with respect to the STS-ENC. Furthermore, they can be utilized 
over other groups such as elliptic curve groups. 



